Skip to content

Privacy Policy

Last updated: August 17, 2026

1. Introduction

Merulan Intelligence, Inc. ("Company", "we", "us") operates the Merulan platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

Information You Provide

  • Account information (name, email address, company name)
  • Workspace and company data you create or connect (entities, records, relationships, source connections)
  • Communication and channel content processed through the Service
  • Files, documents, and other materials you upload or ingest

Information Collected Automatically

  • Usage data (pages visited, features used, actions taken)
  • Device and browser information
  • IP address and approximate location
  • Activity metrics from features and connected channels you use

3. How We Use Your Information

  • Provide, maintain, and improve the Service
  • Process and deliver workspace communications and connected-channel activity
  • Generate analytics and insights over your workspace
  • Power AI-assisted features (search, briefing, drafting, agent and workflow assistance)
  • Send you service-related notifications
  • Detect, prevent, and address technical issues or abuse

4. AI and Data Processing

Merulan uses artificial intelligence to search, summarize, brief, draft, and assist with governed actions over your company model. Your data may be processed by AI models to generate these features. We do not use your data to train general-purpose AI models. AI-generated content that would take an external action is presented for review before that action is taken.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

  • Service providers — third-party services that help us operate (cloud hosting, email delivery, analytics)
  • At your direction — when you send messages or otherwise act through connected channels, relevant data is shared with those channel and delivery providers
  • Legal requirements — when required by law, subpoena, or government request
  • Business transfers — in connection with a merger, acquisition, or sale of assets

Current sub-processors

The following service providers process personal data on our behalf as of the last updated date above:

  • Amazon Web Services — cloud hosting and primary data storage (US)
  • Stripe — payment processing for paid customers (US)
  • Recall.ai — meeting bot capturing audio and transcripts for customer-authorized calls (US)
  • Unipile — operated messaging and multi-channel connectivity (LinkedIn and additional channels); provides hosted authentication, session management, and inbound/outbound message relay for operated connections. Data categories: session connectivity tokens, message content, and contact PII for accounts using operated channels. Data residency: EU (Scaleway, France). SOC 2 Type II (October 2025). Applies only to accounts connected via an operated channel; direct-connected mailboxes (Microsoft 365 direct, Gmail post-CASA) do not route through Unipile.

In addition to the providers named above, Merulan engages a small number of additional service providers for specific platform features such as data enrichment and product analytics. The complete current list of sub-processors is named in each customer's Data Processing Addendum and is available to customers on request at privacy@merulan.com.

We will notify customers of material changes to the sub-processor list (additions, removals, or changes in the data class processed) by email at least 30 days before the change takes effect.

6. Data Security

We implement industry-standard security measures including encryption in transit (TLS) and at rest, role-based access controls, and regular security audits. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Upon account deletion, we will remove your data within 90 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention).

8. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access and receive a copy of your personal data
  • Correct inaccurate or incomplete data
  • Delete your personal data
  • Object to or restrict certain processing
  • Data portability (receive your data in a structured format)
  • Withdraw consent at any time

To exercise these rights, contact us at privacy@merulan.com.

9. Cookies

We use essential cookies for authentication and session management. We do not use third-party tracking cookies. Analytics data is collected server-side without cross-site tracking.

10. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before they take effect.

12. Contact

Questions about this Privacy Policy? Contact us at privacy@merulan.com.